Managing supplier dependencies
Organisation: [complete] · Owner: [complete] · Approved by: [complete]
Effective from: [complete after approval] · Review: [complete]
Objective
The organisation should understand its dependencies and have a workable response to changed terms, outage or service termination. A supplier’s European headquarters alone do not establish security or compliance; data location is only one factor.
Supplier assessment
| Area | Questions and evidence |
|---|---|
| Data and jurisdiction | Who processes data, where processing and support take place, which subprocessors are involved, and what transfer terms apply? |
| Technical dependency | Which APIs, formats and services are difficult to replace? |
| Contract | What are the notification, change, switching assistance and termination terms? |
| Export | What can be transferred, in which format, how quickly and with what limitations? |
| Continuity | What is the impact of unavailability and which alternatives have actually been tested? |
| Switching cost | What work, parallel operation, transfer and contractual charges will be required? |
Base conclusions on contracts, documentation and practical tests. Do not treat executives’ political views or an unvalidated numerical score as objective legal classification. If using internal scoring, describe weights, sources, uncertainty and mandatory criteria; a good average must not hide a critical issue.
Exit plan
Define triggers, decision authority, alternatives, export of data and digital assets, application dependencies, identity management, integrity checks and deletion conditions at the previous provider. Test a representative transfer; downloading a CSV does not establish that the complete service works elsewhere.
Data Act
Chapter VI governs switching between data processing services within its scope. The maximum notice period and the transition period are different. Exceptions apply, and the rules do not create a general right to cancel every contractual commitment free of charge.
The prohibition of switching charges from 12 January 2027 is in Article 29, subject to the Article 31 exceptions for specified custom-built services and time-limited non-production testing versions. It does not automatically remove internal migration costs, ordinary service fees or permissible early-termination penalties. Exportable data and digital assets have defined limits, including protection of third-party rights and trade secrets. Exclusions of internal data categories under Article 25(2)(f) must not impede or delay switching.
Assess specific terms using the cloud switching guide. An internal sovereignty score does not replace assessment under GDPR, the Data Act or cybersecurity supply-chain obligations.
Ongoing review
Reassess significant changes to contracts, subcontractors, services or risk. Maintain a dependency owner and current exit-test results. Set frequency according to service criticality and available alternatives.
Template reviewed on 6 September 2026. Detailed legal sources are in the linked guides. L1 — Align helps prepare evidence and responsibilities; adaptation and implementation scope is agreed in the proposal.
Licence: CC BY-NC-SA 4.0